# Resource Policy help - allow AWS Lex to access deployed Lambda function
**URL:** https://forum.serverless.com/t/resource-policy-help-allow-aws-lex-to-access-deployed-lambda-function/7817
**Category:** Serverless Framework
**Tags:** aws, lambda
**Created:** [March 27, 2019, 4:24pm UTC](https://forum.serverless.com/t/resource-policy-help-allow-aws-lex-to-access-deployed-lambda-function/7817 "2019-03-27T16:24:32Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@glyphCS](https://forum.serverless.com/u/glyphCS)
#### Post date: [March 27, 2019, 4:24pm UTC](https://forum.serverless.com/t/resource-policy-help-allow-aws-lex-to-access-deployed-lambda-function/7817/1 "2019-03-27T16:24:32Z")
I hope someone can help me, or direct me to some sources if possible.
I’m creating a lambda function that should be accessible to Amazon Lex. The usual thing that happens is that I deploy my function, then manually setup the Lex bot using the Console. When setting the dialog and fulfillment code hooks, there is a popup asking me asking for permission to access the lambda function.
Instead, now, I would like to upload a zip file with the pre-configured Lex data, but the Console warns me that the intent can’t access the lambda. I look around and find that adding `resourcePolicy` would be the way to solve this.
But the following error occurs:
```
An error occurred: ApiGatewayRestApi - Invalid policy document. Please check the policy syntax and ensure that Principals are valid. (Service: AmazonApiGateway; Status Code: 400; Error Code: BadRequestException; Request ID: 385e25d5-50a9-11e9-bd93-9bfe4922d6f0).`
```
It’s odd because I’m not even using `resourcePolicy` with Api Gateway, just a regular lambda, so that’s odd.
There’s another issue, and it’s that deploying takes over 15 minutes, and only at the end of a long “Checking Stack Update progress” does it tell me that the policy was invalid in the first place.
Some (hopefully) relevant portion of my serverless.yml file:
```
service: supertest
custom:
secrets: ${file(config.yml)}
provider:
name: aws
runtime: nodejs8.10
stage: dev
resourcePolicy:
- Effect: Allow
Action: Lambda:InvokeFunction
SourceArn: "arn:aws:lex:us-east-1:XYZXYZXYZYXYZ:intent:*"
Resource: "arn:aws:lambda:us-east-1:XYZXYZXYZYXYZ:function:supertest-dev-lex"
iamRoleStatements:
- Effect: Allow
Action:
- Lex:PostText
- Lex:PostContent
Resource: "arn:aws:lex:us-east-1:XYZXYZXYZYXYZ:*"
environment: ${self:custom.secrets}
functions:
lex:
handler: handler.lex
```
---
### Author:  [@degraaf](https://forum.serverless.com/u/degraaf)
#### Post date: [October 28, 2021, 7:23am UTC](https://forum.serverless.com/t/resource-policy-help-allow-aws-lex-to-access-deployed-lambda-function/7817/2 "2021-10-28T07:23:16Z")
Came across this a couple years later but have worked it out with some help from the solution mentioned here:
> [@Is it possible to use configure Lambda Function Resource-based Policies using serverless framework?](http://forum.serverless.com/t/is-it-possible-to-use-configure-lambda-function-resource-based-policies-using-serverless-framework/4932/8):
>
> Tigerwan, did you manage to solve this? I have a similar issue in that I need to create a resource-based function policy for a lambda function so that it can be invoked by CloudWatch events that don’t exist at deploy time (dynamically added cron events).
```auto
functions:
lex-handler:
description: 'Lex Chatbot Lambda function'
handler: index.handler
timeout: 20 # optional, in seconds, default is 6
resources:
Resources:
#
# Lambda resource permission to allow Lex to invoke it
# NOTE - Serverless tries to create resources first so you'll need to comment this
# out on first install and then run again to apply this permission
#
LambdaPermissionInvokeFromLex:
Type: AWS::Lambda::Permission
Properties:
FunctionName: arn:aws:lambda:${aws:region}:${aws:accountId}:function:${self:service}-${self:provider.stage}-lex-handler
Action: lambda:InvokeFunction
Principal: lexv2.amazonaws.com
```
One caveat is that it tries to create resources first and fails because the Lambda does not exist yet.
So I deployed once with the resource commented out and then uncommented and ran again once the Lambda was created. There might be a better solution to that though.